We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·22d ago·5 min read
TFTP Honey Pot Results
TL;DR
A TFTP honey pot was deployed to capture network traffic, revealing mostly scheduled scans from infosec companies. Over 35 days, it recorded consistent probing activity, particularly from Palo Alto Networks.
✦ Why It Matters
Network engineers should consider implementing honey pots to better understand and defend against automated scanning activities.
Key Takeaways
- Deploy a honey pot to monitor network traffic patterns.
- Use whois and grepcidr for traffic analysis.
- Identify and categorize traffic sources for better security insights.
- Analyze probing patterns to enhance network defenses.
Full Summary
A TFTP (Trivial File Transfer Protocol) honey pot was set up on a low-cost VPS and a home server to analyze incoming traffic. Over a month, the honey pot captured between 20 and 50 TFTP packets daily, primarily from seven infosec companies conducting regular scans.
Using tools like whois and grepcidr, the researcher identified the source of the traffic, noting that most requests were for a file named 'a'. Notably, Palo Alto Networks' probes occurred in pairs approximately every 24 hours, with a mean interval of 24.09 hours between the first requests.
The data revealed that many IP addresses lacked A records in DNS, complicating identification. These findings suggest a systematic approach to network scanning by security firms, emphasizing the need for awareness of such automated activities.